CVE-2026-72033 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
orangefs: keep the readdir entry size 64-bit in fill_from_part()
fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32. An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel.
Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry. The trailer is supplied by the userspace client.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the orangefs kernel driver within the Linux operating system, specifically affecting how directory entries are processed during read operations. This issue demonstrates a classic integer overflow and truncation problem that can lead to severe memory safety violations. The flaw occurs in the fill_from_part() function which handles the population of directory entry data structures, making it particularly dangerous as it directly impacts the kernel's file system handling capabilities. Such vulnerabilities represent significant risks to system stability and security as they can be exploited to cause kernel crashes or potentially enable privilege escalation attacks.
The technical implementation flaw stems from improper type handling during size calculations within the directory entry processing logic. The function computes directory entry sizes using size_t data types which can accommodate large values, but subsequently stores these computed sizes in __u32 variables that have limited capacity. This type conversion creates a scenario where values approaching the maximum 32-bit unsigned integer value wrap around to small numbers due to overflow behavior. This wrapping bypasses existing bounds checking mechanisms that were designed to prevent invalid memory access patterns, allowing the system to proceed with malformed entry sizes that reference memory locations far beyond the intended directory structure boundaries.
The operational impact of this vulnerability extends beyond simple kernel oopses and can potentially be exploited in more sophisticated attack scenarios. When an out-of-bounds read occurs, it can result in kernel crashes that may be leveraged for denial-of-service attacks or could provide attackers with information disclosure opportunities through memory corruption patterns. The vulnerability particularly affects systems utilizing the orangefs file system implementation where directory traversal operations are performed, making it relevant to distributed storage environments and high-performance computing clusters that rely on this specific kernel module. According to CWE classification, this represents a variant of CWE-190 Integer Overflow or Wraparound, while the ATT&CK framework would categorize this under privilege escalation techniques involving kernel exploitation.
The mitigation approach requires modifying the size computation logic to use u64 data types throughout the processing pipeline, ensuring that large entry sizes cannot be truncated during storage operations. This fundamental change prevents the wraparound behavior that enables the bypass of bounds checking mechanisms, forcing the system to properly reject malformed directory entries before they can cause memory access violations. The solution also emphasizes proper input validation of user-space supplied data, particularly in cases where kernel code must process untrusted information from client applications. Security researchers should note that this vulnerability highlights the importance of careful type management in kernel space operations and demonstrates how seemingly minor type conversion issues can result in critical security flaws that compromise system integrity and availability.
The root cause analysis reveals that this vulnerability represents a common class of memory safety issues found in kernel code where improper handling of integer types creates exploitable conditions. The issue specifically manifests when processing directory entries near the boundary of 32-bit integer limits, where the truncation behavior becomes exploitable. This pattern aligns with known vulnerabilities in Linux kernel file system implementations and underscores the need for comprehensive input validation and proper type safety in kernel modules. The fix implementation must ensure that all size calculations maintain sufficient precision to prevent overflow conditions while maintaining compatibility with existing system interfaces and user-space applications that may provide directory entry data through the orangefs client implementation.